6481a7e5bb00d270dd03b48a71196d93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6481a7e5bb00d270dd03b48a71196d93_JaffaCakes118
Size

32KB
MD5

6481a7e5bb00d270dd03b48a71196d93
SHA1

61f21a504c9d71fb5a80d2498e2836a9180a6be6
SHA256

0950df23c686a13092bb7eaf485a311ed0a0ceb86c0da1c2de8534d2a1b6b497
SHA512

8808261fdfc7778c7854996f6fc4b1b1a42b2818884366e0cb001f3336526cfb631b5740ef7dd934d4823b9545ef8d80fbcab2e4617183957f13cff4cdef9cc5
SSDEEP

384:ljBS3caTD71SHWVSRDYfFXbDjye6Rd9lLj4ESBgadkubXYZ+GBfXw775RxDc9No8:lHaxSUSSpbDjyFdfn2F9XYgAfX2UNoL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6481a7e5bb00d270dd03b48a71196d93_JaffaCakes118

Files

6481a7e5bb00d270dd03b48a71196d93_JaffaCakes118
.dll windows:4 windows x86 arch:x86

127217e0d38814b4ae44f48089bc424e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_adjust_fdiv
_initterm
malloc
_strdup
free

ntdll

NtQueryInformationProcess
NtSetInformationProcess

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
FlushInstructionCache
ExitProcess
GetTickCount
QueryPerformanceCounter
RtlUnwind
CreateThread
FindClose
FindFirstFileA
GetVolumeInformationA
GetSystemDirectoryA
GetCommandLineA
VirtualProtect
IsBadReadPtr
GetProcAddress
GetModuleHandleA
VirtualFree
LoadLibraryA
VirtualAlloc
GetVersion
VerifyVersionInfoA
VerSetConditionMask
GetCurrentProcess
ExitThread
CloseHandle
Sleep

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ